ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-21 21:14:17 +02:00
Code Issues Projects Releases Packages Wiki Activity

Require exact consent cookie domain

Browse source
This commit is contained in:
Jeremiah Lowin 2026-08-04 17:32:02 -04:00
commit ce58ceec7b
No known key found for this signature in database
14 changed files with 121 additions and 93 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/servers/auth/oauth-proxy.mdx
View file

@ -342,23 +342,23 @@ auth = OAuthProxy(..., client_storage=MemoryStore())
</Warning>
</ParamField>
<ParamField body="consent_cookie_policy" type='Literal["host-only", "domain-compatible"]' default='"host-only"'>
Controls the browser-enforced scope of the signed cookies used by FastMCP's consent flow.
<ParamField body="consent_cookie_domain" type="str | None" default="None">
Sets an explicit domain for the signed cookies used by FastMCP's consent flow. By default, FastMCP uses `__Host-` cookies on HTTPS, which browsers restrict to the exact host.
- `"host-only"` (default) uses the `__Host-` prefix on HTTPS. This is the strongest policy because browsers reject a `Domain` attribute and prevent sibling subdomains from setting the cookie.
- `"domain-compatible"` uses the `__Secure-` prefix on HTTPS. Use this only when a hosting layer, such as Azure Functions, adds a `Domain` attribute to response cookies. Cookie signing, `Secure`, `HttpOnly`, and `SameSite=Lax` remain enabled, but browser-enforced host isolation is lost.
Set this only when a hosting layer, such as Azure Functions, adds a `Domain` attribute to response cookies. The value must exactly match the hostname in `base_url`; FastMCP rejects parent domains. Configuring it uses `__Secure-` cookies and preserves signing, `Secure`, `HttpOnly`, and `SameSite=Lax`.
```python
from fastmcp.server.auth.providers.azure import AzureProvider
auth = AzureProvider(
...,
consent_cookie_policy="domain-compatible",
base_url="https://my-app.azurewebsites.net",
consent_cookie_domain="my-app.azurewebsites.net",
)
```
<Warning>
Prefer the default `"host-only"` policy. The compatibility policy allows consent cookies to be scoped to sibling subdomains and should only be enabled when the deployment platform makes `__Host-` cookies unusable.
Prefer the host-only default. A domain cookie is also sent to child subdomains, so only enable this when those hosts are trusted and the deployment platform makes `__Host-` cookies unusable.
</Warning>
</ParamField>

4
docs/servers/auth/oidc-proxy.mdx
View file

@ -209,8 +209,8 @@ auth = OIDCProxy(
Consent screen behavior for authorization requests. Accepts `True` (default; always prompt — strongest protection), `"remember"` (silent consent on return visits via signed cookie, gated by `Sec-Fetch-Site` to block AS-in-the-middle attacks), `"external"` (same authorization path as `False`, but the warning is suppressed because the operator asserts that equivalent protections are enforced externally), or `False` (disable entirely; local/testing only). See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for full details on each mode and the security trade-offs.
</ParamField>
<ParamField body="consent_cookie_policy" type='Literal["host-only", "domain-compatible"]' default='"host-only"'>
Consent cookie scope policy. The default `"host-only"` uses `__Host-` cookies on HTTPS. `"domain-compatible"` uses `__Secure-` cookies for hosting layers that add a `Domain` attribute, weakening browser-enforced host isolation while retaining signed, `Secure`, `HttpOnly`, `SameSite=Lax` cookies. See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for the security trade-off.
<ParamField body="consent_cookie_domain" type="str | None" default="None">
Explicit domain for consent cookies. By default, FastMCP uses host-only `__Host-` cookies on HTTPS. Set this only for hosting layers that add a `Domain` attribute; the value must exactly match the hostname in `base_url`. See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for the security trade-off.
</ParamField>
<ParamField body="consent_csp_policy" type="str | None" default="None">

12
docs/v2/servers/auth/oauth-proxy.mdx
View file

@ -323,23 +323,23 @@ auth = OAuthProxy(..., client_storage=MemoryStore())
</Warning>
</ParamField>
<ParamField body="consent_cookie_policy" type='Literal["host-only", "domain-compatible"]' default='"host-only"'>
Controls the browser-enforced scope of the signed cookies used by FastMCP's consent flow.
<ParamField body="consent_cookie_domain" type="str | None" default="None">
Sets an explicit domain for the signed cookies used by FastMCP's consent flow. By default, FastMCP uses `__Host-` cookies on HTTPS, which browsers restrict to the exact host.
- `"host-only"` (default) uses the `__Host-` prefix on HTTPS. This is the strongest policy because browsers reject a `Domain` attribute and prevent sibling subdomains from setting the cookie.
- `"domain-compatible"` uses the `__Secure-` prefix on HTTPS. Use this only when a hosting layer, such as Azure Functions, adds a `Domain` attribute to response cookies. Cookie signing, `Secure`, `HttpOnly`, and `SameSite=Lax` remain enabled, but browser-enforced host isolation is lost.
Set this only when a hosting layer, such as Azure Functions, adds a `Domain` attribute to response cookies. The value must exactly match the hostname in `base_url`; FastMCP rejects parent domains. Configuring it uses `__Secure-` cookies and preserves signing, `Secure`, `HttpOnly`, and `SameSite=Lax`.
```python
from fastmcp.server.auth.providers.azure import AzureProvider
auth = AzureProvider(
...,
consent_cookie_policy="domain-compatible",
base_url="https://my-app.azurewebsites.net",
consent_cookie_domain="my-app.azurewebsites.net",
)
```
<Warning>
Prefer the default `"host-only"` policy. The compatibility policy allows consent cookies to be scoped to sibling subdomains and should only be enabled when the deployment platform makes `__Host-` cookies unusable.
Prefer the host-only default. A domain cookie is also sent to child subdomains, so only enable this when those hosts are trusted and the deployment platform makes `__Host-` cookies unusable.
</Warning>
</ParamField>

4
docs/v2/servers/auth/oidc-proxy.mdx
View file

@ -202,8 +202,8 @@ auth = OIDCProxy(
Consent screen behavior for authorization requests. Accepts `True` (default; always prompt — strongest protection), `"remember"` (silent consent on return visits via signed cookie, gated by `Sec-Fetch-Site` to block AS-in-the-middle attacks), `"external"` (same authorization path as `False`, but the warning is suppressed because the operator asserts that equivalent protections are enforced externally), or `False` (disable entirely; local/testing only). See the [OAuthProxy documentation](/v2/servers/auth/oauth-proxy) for full details on each mode and the security trade-offs.
</ParamField>
<ParamField body="consent_cookie_policy" type='Literal["host-only", "domain-compatible"]' default='"host-only"'>
Consent cookie scope policy. The default `"host-only"` uses `__Host-` cookies on HTTPS. `"domain-compatible"` uses `__Secure-` cookies for hosting layers that add a `Domain` attribute, weakening browser-enforced host isolation while retaining signed, `Secure`, `HttpOnly`, `SameSite=Lax` cookies. See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for the security trade-off.
<ParamField body="consent_cookie_domain" type="str | None" default="None">
Explicit domain for consent cookies. By default, FastMCP uses host-only `__Host-` cookies on HTTPS. Set this only for hosting layers that add a `Domain` attribute; the value must exactly match the hostname in `base_url`. See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for the security trade-off.
</ParamField>
<ParamField body="consent_csp_policy" type="str | None" default="None">

12
docs/v3/servers/auth/oauth-proxy.mdx
View file

@ -337,23 +337,23 @@ auth = OAuthProxy(..., client_storage=MemoryStore())
</Warning>
</ParamField>
<ParamField body="consent_cookie_policy" type='Literal["host-only", "domain-compatible"]' default='"host-only"'>
Controls the browser-enforced scope of the signed cookies used by FastMCP's consent flow.
<ParamField body="consent_cookie_domain" type="str | None" default="None">
Sets an explicit domain for the signed cookies used by FastMCP's consent flow. By default, FastMCP uses `__Host-` cookies on HTTPS, which browsers restrict to the exact host.
- `"host-only"` (default) uses the `__Host-` prefix on HTTPS. This is the strongest policy because browsers reject a `Domain` attribute and prevent sibling subdomains from setting the cookie.
- `"domain-compatible"` uses the `__Secure-` prefix on HTTPS. Use this only when a hosting layer, such as Azure Functions, adds a `Domain` attribute to response cookies. Cookie signing, `Secure`, `HttpOnly`, and `SameSite=Lax` remain enabled, but browser-enforced host isolation is lost.
Set this only when a hosting layer, such as Azure Functions, adds a `Domain` attribute to response cookies. The value must exactly match the hostname in `base_url`; FastMCP rejects parent domains. Configuring it uses `__Secure-` cookies and preserves signing, `Secure`, `HttpOnly`, and `SameSite=Lax`.
```python
from fastmcp.server.auth.providers.azure import AzureProvider
auth = AzureProvider(
...,
consent_cookie_policy="domain-compatible",
base_url="https://my-app.azurewebsites.net",
consent_cookie_domain="my-app.azurewebsites.net",
)
```
<Warning>
Prefer the default `"host-only"` policy. The compatibility policy allows consent cookies to be scoped to sibling subdomains and should only be enabled when the deployment platform makes `__Host-` cookies unusable.
Prefer the host-only default. A domain cookie is also sent to child subdomains, so only enable this when those hosts are trusted and the deployment platform makes `__Host-` cookies unusable.
</Warning>
</ParamField>

4
docs/v3/servers/auth/oidc-proxy.mdx
View file

@ -202,8 +202,8 @@ auth = OIDCProxy(
Consent screen behavior for authorization requests. Accepts `True` (default; always prompt — strongest protection), `"remember"` (silent consent on return visits via signed cookie, gated by `Sec-Fetch-Site` to block AS-in-the-middle attacks), `"external"` (same authorization path as `False`, but the warning is suppressed because the operator asserts that equivalent protections are enforced externally), or `False` (disable entirely; local/testing only). See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for full details on each mode and the security trade-offs.
</ParamField>
<ParamField body="consent_cookie_policy" type='Literal["host-only", "domain-compatible"]' default='"host-only"'>
Consent cookie scope policy. The default `"host-only"` uses `__Host-` cookies on HTTPS. `"domain-compatible"` uses `__Secure-` cookies for hosting layers that add a `Domain` attribute, weakening browser-enforced host isolation while retaining signed, `Secure`, `HttpOnly`, `SameSite=Lax` cookies. See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for the security trade-off.
<ParamField body="consent_cookie_domain" type="str | None" default="None">
Explicit domain for consent cookies. By default, FastMCP uses host-only `__Host-` cookies on HTTPS. Set this only for hosting layers that add a `Domain` attribute; the value must exactly match the hostname in `base_url`. See the [OAuthProxy documentation](/servers/auth/oauth-proxy) for the security trade-off.
</ParamField>
<ParamField body="consent_csp_policy" type="str | None" default="None">